From file-sharing to prison: A Megaupload programmer tells his story

Andrus Nõmm is the only Megaupload criminal copyright defendant to have gone to prison.Toivo Tänavsuu
Soon after the domain was registered in Hong Kong, the now-defunct Megaupload.com grew into one of the world’s most popular file-sharing sites.

At its peak, the site engaged nearly 50 million users a day and took up around four percent of the world’s Internet traffic. Users uploaded nearly 12 billion files overall.
But the infamy of the site’s rise is only matched by the infamy of its fall.In January 2012, US authorities closed down Megaupload.com and the network related to it.

The feds arrested seven people and froze $50 million in assets. The FBI claims that the site not only failed to take down illegal material, Megaupload also helped to spread it. Perhaps it was simply a case of brazen arrogance. When the authorities finally raided founder Kim Dotcom’s large villa in New Zealand, they found a number of luxury cars (Lamborghini, Maserati, Rolls Royce) with the license plates “God,” “Mafia,” “Hacker,” “Evil,” and “Police.”
In total, seven men associated with the site were arrested and indicted on 13 charges (including copyright infringement and money laundering).

Dotcom remains notably free and has been continually fighting in New Zealand against his extradition to the USA. Others were not as lucky.
Take for instance self-taught programmer Andrus Nõmm.

The now 37-year-old grew up in a small Estonian town called Jõhvi. When he built up the Mega advertising platform Megaclick and the video hosting service Megavideo, Nõmm earned as much as $10,000 a month—more than he could’ve ever imagined as a child. But when US authorities came after the entire Megaupload operation, suddenly he found himself in the middle of the world’s most sensational criminal copyright infringement scandal.
The legal saga dragged on for three years.In 2012, Nõmm was first arrested by authorities in the Netherlands and placed under house arrest. Like Dotcom, Nõmm next spent a significant amount of time fighting extradition.

But eventually in 2015, he voluntarily traveled to the US and was arrested in Virginia. Nõmm pleaded guilty to felony copyright infringement and was sentenced to a year and a day in a US federal prison.

The US Attorney General’s office called the conviction, “a significant step forward in the largest criminal copyright case in US history.” In court documents, Nõmm acknowledged the financial harm to copyright holders “exceeded $400 million.”
While in prison, Nõmm’s teenage son and Turkish wife lived through all of this drama back in their home in Izmir, Turkey. Today, Nõmm is back with them. He’ a free man looking to set his life back on track.

And recently, he agreed to share his side of the story—from Megaupload glory through prison time—with Estonian journalist Toivo Tanävsuu.
The following Q&A is made of selected excerpts from Tanävsuu’s interview, which was originally published in the Estonian weekly Eesti Ekspress this past April.It has been translated into English and lighted edited for clarity.It’s reprinted here with permission from Tanävsuu.Tanävsuu: Describe your life in the Netherlands up to February 2015.
Nõmm: I lived on Katendrecht Peninsula in Rotterdam.

At first I had to wear a GPS device and stay within 500 meters of my home.

The supermarket was 550 meters away.I had to walk to the edge of this area and wait there until someone bought my goods and brought them to me.

After a while, they relaxed the restrictions and the area in which I was allowed to move increased until finally the GPS device was removed altogether.I was allowed to move around everywhere in the Netherlands, except anywhere within 50 kilometers of the border. When my son was visiting and we wanted to go to an amusement park in a town near the border, I had to get a special permit.
I wasn’t allowed to go to the airport either.Since most trains run through Schiphol, I had to drive the long way around to get from Rotterdam to Amsterdam.Why did you initially fight against your extradition?
First of all, I couldn’t understand why I was being hunted down.

The Dutch court papers didn’t include at least half of the accusations which had been in the media.

For example, we do not have a single section in the law in Europe about racketeering, which in the USA automatically leads to a 25-year sentence.Secondly, I did not know what was going to happen to me if I went to the USA.

The maximum possible penalty for all 13 counts would have been 55 years in prison.Were you able to work?
The Netherlands wanted me to work.I didn’t have any money because my bank accounts in Turkey and Hong Kong had been seized and the US government confiscated about $40,000 from them.

The FBI put me on the black list, which meant that I couldn’t transfer my earnings to a bank.I had to let them transfer my salary to a friend’s account.The Americans wanted to use you against Kim Dotcom. What were the FBI’s proposals?
They tried to get in contact with me, but when my lawyer asked why, they didn’t reply.
I had three lawyers in total.

The first, appointed by the state, didn’t even notify me that the FBI were trying to get in contact.

The second was famous but turned out to be a complete fake—taking money from clients, but not doing much at all and now facing trial. My last lawyer came through Megaupload and was really good.

But Kim never paid the man a single cent.

All Kim ever cared about was how to promote himself on Twitter. He has never given me any real help.In February 2015, you voluntarily decided to fly to the US. Why?
The US prosecutors kept insisting that I should talk to them.

Finally, we met with a couple of FBI representatives at my lawyer’s office in Amsterdam.

The Americans confirmed that they had strong evidence against me, and that I didn’t stand a chance.

They claimed that I had either uploaded or downloaded some sort of illegal movie in Megaupload.Since I myself programmed the video converter system for the site, I downloaded and uploaded files constantly without watching them.
They wanted me to confess to knowing that Megaupload was earning big money from illegal movies.

This I read only later on the Internet.I didn’t deal with financial issues in the company.What options did you have?
I had the chance to fight for another 10 years and .00001 percent probability of winning in court, to live week-to-week worried about how to support my family.

They would’ve extradited me sooner or later and I would’ve received a tough punishment in the USA: I most likely would have spent 5-10 years behind bars.

“I had the chance to fight for another 10 years and .00001 percent probability of winning in court, to live week-to-week worried about how to support my family.

They would’ve extradited me sooner or later.”

I chose a shortened procedure.I pleaded guilty to felony copyright infringement and made an agreement with the prosecutors to sit in prison for a year.

All the bigger accusations, such as money laundering, dropped away since I wasn’t the owner of the company.I also had to sign my name to all of the evidence that had already been collected—for example, to the fact that Megaupload ignored complaints from time to time and did not remove illegal content fast enough.If anyone had any doubts about a file, Kim always calmed them down and said there was nothing to worry about.I had to be made an example of as a warning to all IT people who were intending to work in similar companies.Deep down, did you feel guilty of anything?
I still think I shouldn’t have been on the list of defendants.
At the beginning, the Dutch Attorney-General was involved, then less and less important prosecutors until my case landed in the lap of some random intern.

That shows how important the issue really was.It turned out that I was the only defendant in the last 29 years to voluntarily go from the Netherlands to the USA.I was asked to come to the police station 24 hours earlier.

There I was shoved in the punishment cell with all the lowlifes.Since I’d been playing computer games and talking to my friends from dusk till dawn for two or three days in a row, I was so tired that I immediately fell asleep.

Did they think you were some kind of gangster?
I quickly learned that if you act normally and don’t do anything stupid, they treat you normally.I watched some movies during the flight and asked them to loosen the handcuffs while I was eating.Did you fly on an ordinary commercial flight?
Yes, we flew to Washington, DC.

From there, I was taken by car to Alexandria in Virginia. I was held in a detention center for a few weeks, and that was worse than prison. You share a closed room which is maybe two by three meters, and you only get out for six to seven hours a day.

There are no beds. You only get a 3-4 centimeter thick piece of polyurethane foam which you can lay down on the concrete floor.

The toilet is in the same room.If you need to “feed the jaruzel” [Polish saying] as they call it, you try and time it to coincide with your daily walk.
There are no books. You just stare at the wall or talk to your cellmate. My cellmate had been caught drunk-driving for the third time. Luckily, we’d both travelled a lot and this made it easy to talk to each other.And outside the cell?
You just got to sit around and watch those meaningless American TV shows, take a shower, or eat.Did they give you enough food?
They gave us enough so that we didn’t die.I was starving all the time.

There were three or four different menus with a list of different things: hamburgers, meatloaf, steak.

But no matter what you asked for, they always brought you a tiny, bland burger.Did you go to court?
They took me from the detention center to the court across the road about four or five days after I arrived.Virginia is an army state and its courts have the toughest laws going.If you do something wrong, do it anywhere else—not in Virginia.It turned out at the court that the agreement I’d signed in the Netherlands had disappeared!
I actually had to sign a paper with counts to which I hadn’t confessed—for example, the claim that I knew that Megaupload was earning millions.Did you feel as if you were being blackmailed?
The whole case was blackmail.

They were just waiting for the defendant to get tired of fighting and give up.It’s not the one who’s in the right who wins, but the one who has the most staying power.
We signed the new agreement half an hour before the hearing.

But then the judge started rambling on that the case was big and he needed at least 90 days to decide—something else new! They brought in a bunch of papers again and my financial and psychological profile was compiled.

They used very specific English in court, but nobody was interested in whether I needed an interpreter or not.In the end, you were sentenced to a year and a day in prison with three years’ probation, right?
As was agreed.

The lawyer put me under pressure and demanded that I agree to a year and a day because if you are sentenced to a prison for less than a year, then there is no way to be released 15 percent earlier for good behavior.It was said in the media that you gave the FBI valuable information which will help put together a better case against others involved in Megaupload.Is that true?
I wasn’t interrogated.

They had factual evidence in the form of digital correspondence and Skype logs.I didn’t tell them anything they didn’t already know.
Enlarge / Kim Dotcom living the high life.
Kim Dotcom

You didn’t turn your friends in?
Kim wasn’t my friend. We worked in different countries.I talked to him online a couple of times a year.

The last time we met was at a company party in Hong Kong in 2010.I was just dealing with technical stuff.I didn’t get wasted like the others.It was also said that you all had to pay a couple of million dollars to compensate losses.
To be precise, the deficit is $450 million! Hollywood lost $500 million in revenue due to piracy, minus $50 million in seized property.Since I didn’t have a penny and I wasn’t a shareholder of the company, the judge decided I only had to pay $100 in legal costs.I’ll never get back the $40,000 that was seized by the USA.Did they take you to prison by car?
Prisoners in the US are taken from one place to another on grey buses with bars just like in the movies. You’re put in shackles, so you can only take very small steps at a time, and you’re handcuffed.It doesn’t matter whether you’re a high or low security risk.

Everyone’s put on the same bus. You don’t get any food, you can’t go to the toilet, and sometimes you drive for 12 hours straight.
They never send you straight to where you’re going. You drive through a number of other prisons first.If you make trouble, say by complaining to the judge that your rights are being violated, you’re put through this thing called “diesel therapy.” They bounce you back and forth between prisons like a ping-pong ball.Did they do this to you, too?
I was taken from Alexandria to Brooklyn, from there to Pennsylvania, from there back to Brooklyn, and from there to Pennsylvania again—a total of about 16 hours of driving.

Before I got to where I was meant to be going, I was put in two different prisons, one of which was a supermax prison where they keep the worst of the worst.I was there for 10 days.

There are more than 2.5 million prisoners in the United States.

Almost one percent of the whole population is in prison, and that’s a huge problem.

But what surprised me most was that there are private prisons in the US.

The more prisoners, the more money you get from the state.It’s big business.You were sent to Moshannon Valley prison in Pennsylvania. What kind of place is it?
Since I was an immigrant, I’d never been to the US.I went there without a visa and I’d leave without one—they put me in the correctional center for foreigners.It was in a forest in the middle of nowhere.

An acquaintance of mine wanted to visit me and it took him several hours just to find the place.

GPS didn’t help.

The nearest airport was 6-7 hours’ drive away.
The prisoners were in barracks, 80 men to a block.

There were five buildings altogether, each of them with six blocks like some kind of big hospital. We had two large gardens with a soccer field on one side and a baseball field on the other.In the middle was a large area where you could lift weights. Most of the inmates did sports.I wasn’t interested in body-building or getting tattoos.I just walked around for hours or read.
There were no walls, just a chain-link fence and barbed wire.

Every now and then some girls drove past and stuck their heads out of the window, waving and screaming. Half the guys rushed to the fence to stare at them.

Who did you share your cell with?
In Brooklyn, I shared my cell with a young American IT guy. We could talk for days. We played soccer barefoot just to fill in the time.

The worst thing was if you didn’t get tired during the day that meant you couldn’t sleep.What did you do in the prison in Pennsylvania?
I read a lot, four or five books a week.I scribbled some plans and specifications for my projects, or watched stupid American TV series.I took Spanish and Chinese courses. Not much of either stuck, but at least it took up my time.I also took alternative energy courses; one of the prisoners was the former owner of a huge green energy company.In my last few weeks there I myself gave some computing courses.I talked about how to make a website, what HTML was, and so on.You had computers there?
No, I taught them on paper.I talked about the hardware: what a hard drive is, and a monitor, and a smartphone; why we need passwords.Some of the men had been in prison for 20 years.

There were Jamaicans, Slavic guys, and Spanish-speaking people in the group.Did the Estonian state support you while you were in prison?
Estonia was the only country that didn’t give its people any support.

All the other countries gave their prisoners at least some pocket money.

Even 10-20 euros would’ve been a great help, because you don’t even get normal soap for free there, not to mention shampoo. You’re given toothpaste whose “best before” was in 2005 and two 20 x 40 cm towels for your whole body for half a year.
But there’s a shop.If you have money, you can buy everything.Some friends and my family sent me money.Did you get your own little corner?
I was given a tiny metal box, but it was impossible to lock it.Still, nobody stole from anyone else. Otherwise they would have been blacklisted.

The guards don’t have full control of prisons in the US.

Each nationality group has its own go-between who, if they need to, sorts out strife.

The Hispanics have their own, the black guys have their own, the Chinese have their own, and so on.Weren’t you afraid?
It was a low-risk prison. Most of the inmates had come across the border or been caught living in the US without a passport.

There were some habitual criminals, of course. You just need to know when to keep your mouth shut and walk away.I come from Ida-Viru County.I have some experience with people like that.It wasn’t particularly easy being an Estonian in Ida-Viru County when Estonia regained its independence from the Soviet Union.
I only ever saw two fights in prison. One of them started because somebody switched the channel on the TV.

The second one was when somebody made a bad joke about the other guy’s girlfriend.Did you also get to work and earn money?
Everybody had to work at least 20 hours a week: unclogging the toilets, digging pits, painting, or helping sort the books.

But guess how much we were paid per hour? Twelve cents per hour! A pack of coffee cost $4. You work for a month and get a pack of coffee! One prisoner told me he’d started fighting in his last prison so he’d be sent away.It was located near a cornfield in Louisiana and the prisoners were working in the field for a dollar a day.What was the most frustrating aspect of the whole experience?
You’re like a sheep in the US prison system. When you’re being transported from one place to another and it’s cold outside, they make you stand outside in your socks and T-shirt.It’s perfectly normal to be put in solitary for three weeks with nothing to read.It’s your own problem if you go crazy. You don’t have any rights.What about your health?
I had a few problems.

All of them were solved with painkillers.You were in prison for 10-and-a-half months.

Then you applied for parole?
If you don’t do anything wrong, freedom’s granted automatically after you’ve served 85 percent of your time.I was taken to a prison in New York for a few days before my flight home. My release day was 25 November—Thanksgiving.

As this was followed by days off, I was held in prison for five days longer.I called the Estonian Embassy and said that in my view this wasn’t right.

They didn’t see the problem. Other countries vigorously defended the rights of their own prisoners.It’s weird how the Estonian government kowtows before the USA.
I had two options: either I buy a plane ticket myself or let the US government buy one for me. My family bought me the ticket. One Belarusian guy who was meant to be released on the same day let the officials buy him a ticket.So he sat in prison for another three months.How are you different today to the person you were a year ago?
Prison didn’t change me.It was like detention in school.

But I’m different today from what I was before 2012.I have less trust in all sorts of state affairs, especially big countries.I saw the dark side of the American dream in all its glory. Many people think it’s some paradise.

Actually, it’s just one big system.

The US, China, Russia—take your pick.It sounds like you’ve lost faith in American democracy.
Can you call forcing your policies on other countries “democracy?” If you have the money, you have the right.Since the US is a capitalist country, that principle is particularly relevant.

“Kim keeps babbling on about how he helps everybody and is such a great freedom fighter, but the reality is something else. Kim’s always been interested in the well-being of just one person, and that’s Kim himself.”

I don’t believe the US will help Estonia in any war.

They also promised to help Ukraine, but did they really?What do you regret most?
I was a bit blind before.It cost me several years of my life.I learned a lot of new things while working in Megaupload.I met some brilliantly clever people.

But I should have understood better what kind of person Kim actually was.Kim has said that he sent you money during the hard times in Rotterdam.
Bramos (Bram van der Kolk, one of the key Dutch players in Megaupload) helped me. His parents transferred some money to me.I don’t know who was actually behind the transfer.Some of the guys were flying around in helicopters in New Zealand while I was languishing in Rotterdam. Kim keeps babbling on about how he helps everybody and is such a great freedom fighter, but the reality is something else. Kim’s always been interested in the well-being of just one person, and that’s Kim himself.

As time went by, I realized more clearly that I was fighting on my own.You’re the only one from Megaupload who’s faced court in the USA, right?
The police used the special unit, helicopters, semi-automatics, and dogs to catch Kim Dotcom during a raid in New Zealand, which turned out to be a total mess.

A lot of those things weren’t in accordance with the law.

They put on a show of strength to win the favor of the United States.

The whole extradition process got stuck in court.

As for me, everything in the Netherlands was done exactly as in the papers, which means correctly.Andrus Nõmm

When did you last talk to Kim?
He called me two or three months after all of this began, but we haven’t communicated since.
I know how much money they were wasting in the company, and my salary wasn’t worth doing the job for that last year. Kim offered me a million dollars as an option if he would eventually sell the company.

Back then I believed him.He has said he understands your decision to plead guilty, do the time, and move on?
He’s only saying that to make himself look better. He even tried to go into politics in New Zealand to win the elections and change the law so they couldn’t extradite him.Does he hold a grudge against you?
Even if he does, he’s not stupid. He understands that social media has a massive influence.

Civil war within Megaupload isn’t in his best interests. He’s this martyr, this freedom fighter….
He’ll eventually end up in the US. He’ll most likely throw everyone under the bus. Kim’s only interested in Kim.

The show he gives online isn’t Kim.How did your son cope with all of this?
He’s 13. He knows exactly what happened. He’s not a kid any more.At least you’re famous now.
Yes, loads of US publications have requested interviews.I’ve turned them all down.

For example, Vice TV kept on me for several months.I’m not interested in the tabloid press.I was afraid that when I got out of prison, I’d really have to work hard to find a job.

But it wasn’t a problem.I received all sorts of interesting offers during my last couple of months in prison.I was asked to contact them as soon as I got home.I still don’t understand how everybody knew when I was getting out.

There’s enough work, but I avoid sharing any files!So, your life is now back on track?
There are still a few problems I have to deal with.I need to pay my friends back for the Rotterdam period.I also owe the bank money.

They didn’t care that I was in another country for some time and couldn’t pay my bills.Are the FBI haunting you any more?
I’m a 100 percent clean, and that won’t change. However, they might start questioning me if Kim faces court in the USA.What do you dream of?
All my dreams were fulfilled by the time I was 25.I grew up in a poor family and left Estonia in 2000. My goal was to find a decent place to live—not some villa, but not a one-bedroom apartment in a dodgy neighborhood either.I wanted a normal car, a family, and an income which could get me anything I wanted.I had all of this before 2006, when I started working for Megaupload.

At the moment, I just want to heal all of the wounds from the last four years.

CATEGORIES

Cyber Parse was created to provide knowledge to help everyone understand and deal with the ever increasing threats we all face by Cyber Crime (Malware, Social Engineering, Phishing and hacking).
Our purpose is to provide the right information to our readers by breaking down and communicating knowledge relating to Cyber Crime, Cyber Security, Information Security and Computer Security, then using Risk Management practices to help translate the technical aspects of the Risks, Threats, Vulnerabilities and controls to reduce the risk into business language.